@sourcey/catalog-verifier 1.1.22 → 1.1.24

package/dist/modules/agent-readiness-engine/src/authority.d.ts

@@ -0,0 +1,81 @@
+import type { ExchangeRecord } from "provenry/exchange/records";
+import { type Challenge } from "./challenges.js";
+/**
+ * The authority chain an *authority* answer, or an error before authority,
+ * points to (north star §5.5): RFC 9728 protected-resource metadata, then the
+ * authorization server's RFC 8414 or OpenID metadata, then its auth.md agent
+ * registration or how Sourcey's agent can identify itself as an OAuth client,
+ * then whether a PKCE authorization request with that client reaches consent.
+ * These are the pure readings; the probe suite performs the exchanges.
+ */
+/** The Bearer challenge's parameters an agent follows: where the metadata is, and what scope. */
+export declare function bearerChallenge(record: ExchangeRecord): Challenge | null;
+/**
+ * Where the protected-resource metadata for a resource is: the challenge's
+ * `resource_metadata`, else RFC 9728 §3.1's well-known location with the
+ * resource's path inserted, then at the root.
+ */
+export declare function protectedResourceMetadataUrls(resource: string, challenge: Challenge | null): readonly string[];
+/** RFC 9728 metadata as published: the resource, its authorization servers and its scopes. */
+export declare function protectedResourceMetadata(document: unknown): {
+    readonly resource: string;
+    readonly authorizationServers: readonly string[];
+    readonly scopes: readonly string[];
+} | null;
+/** RFC 9728 metadata for a resource on the operation's origin: its first authorization server. */
+export declare function readProtectedResource(document: unknown, operationUrl: string): {
+    readonly authorizationServer: string;
+    readonly scopes: readonly string[];
+} | null;
+/**
+ * Where an authorization server's metadata is, in the order MCP clients try:
+ * RFC 8414 with the issuer's path inserted, OpenID with it inserted, OpenID
+ * with it appended; or, for an issuer without a path, RFC 8414 then OpenID.
+ */
+export declare function authorizationServerMetadataUrls(issuer: string): readonly string[];
+export interface AuthorizationServerMetadata {
+    readonly issuer: string;
+    /** Null for a server that only registers agents (auth.md) and runs no authorization flow. */
+    readonly authorizationEndpoint: string | null;
+    readonly registrationEndpoint: string | null;
+    readonly clientIdMetadataDocument: boolean;
+    /** S256 is listed: an MCP client refuses a server that does not list it. */
+    readonly pkce: boolean;
+    /**
+     * The server's auth.md agent registration (`agent_auth` with an
+     * `identity_endpoint`): `agent` when it offers `anonymous`, which needs no
+     * person; `claimable` when it offers only `service_auth` or
+     * `identity_assertion`, which a person claims or confirms once.
+     */
+    readonly registration: "agent" | "claimable" | null;
+    /** A renewal grant is offered: refresh, or with auth.md the JWT-bearer exchange of its assertion. */
+    readonly renewal: boolean;
+    /** A revocation endpoint is named. */
+    readonly revocation: boolean;
+}
+/** Server metadata for exactly this issuer (RFC 8414 §3.3), or null. */
+export declare function readAuthorizationServer(document: unknown, issuer: string): AuthorizationServerMetadata | null;
+/** The client id a dynamic registration returned, or null. */
+export declare function registeredClientId(document: unknown): string | null;
+/**
+ * The PKCE authorization request a probe sends: Sourcey's client, its redirect
+ * URI, a challenge derived from the run's nonce, and the resource and scope the
+ * chain named. Sourcey never redeems a code, so the verifier is never sent.
+ */
+export declare function authorizationRequestUrl(input: {
+    readonly authorizationEndpoint: string;
+    readonly clientId: string;
+    readonly resource: string;
+    readonly scopes: readonly string[];
+    readonly nonce: string;
+}): string;
+/**
+ * Whether an answered authorization request reached consent: the server
+ * accepted it and moved to the person's sign-in or consent, answering with a
+ * page (2xx HTML) or redirecting, with no `error`, anywhere but back to
+ * Sourcey. A redirect back carries an error or a code Sourcey discards; a
+ * redirect carrying `error` refused the client; any other answer refused it
+ * too. An unanswered request is residue (`probeUnanswered`) and never read here.
+ */
+export declare function consentReached(record: ExchangeRecord): boolean;
+//# sourceMappingURL=authority.d.ts.map

package/dist/modules/agent-readiness-engine/src/authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority.d.ts","sourceRoot":"","sources":["../../../../modules/agent-readiness-engine/src/authority.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,EAAE,KAAK,SAAS,EAAmB,MAAM,iBAAiB,CAAC;AAIlE;;;;;;;GAOG;AAEH,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,GAAG,IAAI,CAIxE;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,GAAG,IAAI,GAC1B,SAAS,MAAM,EAAE,CASnB;AAED,8FAA8F;AAC9F,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,OAAO,GAAG;IAC5D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GAAG,IAAI,CAaP;AAED,kGAAkG;AAClG,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,OAAO,EACjB,YAAY,EAAE,MAAM,GACnB;IAAE,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAKrF;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAajF;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6FAA6F;IAC7F,QAAQ,CAAC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9C,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,GAAG,WAAW,GAAG,IAAI,CAAC;IACpD,qGAAqG;IACrG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,sCAAsC;IACtC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAID,wEAAwE;AACxE,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,MAAM,GACb,2BAA2B,GAAG,IAAI,CAsBpC;AAgBD,8DAA8D;AAC9D,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAGnE;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GAAG,MAAM,CAYT;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAoB9D"}

package/dist/modules/agent-readiness-engine/src/authority.js

@@ -0,0 +1,189 @@
+import { createHash } from "node:crypto";
+import { AGENT_READINESS_REDIRECT_URI } from "../../../contracts/agent-readiness/src/index.js";
+import { parseChallenges } from "./challenges.js";
+import { httpsUrl, record } from "./documents.js";
+import { responseHeader, unansweredRecord } from "./records.js";
+/**
+ * The authority chain an *authority* answer, or an error before authority,
+ * points to (north star §5.5): RFC 9728 protected-resource metadata, then the
+ * authorization server's RFC 8414 or OpenID metadata, then its auth.md agent
+ * registration or how Sourcey's agent can identify itself as an OAuth client,
+ * then whether a PKCE authorization request with that client reaches consent.
+ * These are the pure readings; the probe suite performs the exchanges.
+ */
+/** The Bearer challenge's parameters an agent follows: where the metadata is, and what scope. */
+export function bearerChallenge(record) {
+    const header = responseHeader(record, "www-authenticate");
+    if (header === null)
+        return null;
+    return parseChallenges(header).find(({ scheme }) => scheme === "bearer") ?? null;
+}
+/**
+ * Where the protected-resource metadata for a resource is: the challenge's
+ * `resource_metadata`, else RFC 9728 §3.1's well-known location with the
+ * resource's path inserted, then at the root.
+ */
+export function protectedResourceMetadataUrls(resource, challenge) {
+    const named = oauthUrl(challenge?.params.resource_metadata);
+    if (named)
+        return [named];
+    const url = new URL(resource);
+    const path = url.pathname.replace(/\/+$/u, "");
+    return [
+        ...(path ? [`${url.origin}/.well-known/oauth-protected-resource${path}`] : []),
+        `${url.origin}/.well-known/oauth-protected-resource`,
+    ];
+}
+/** RFC 9728 metadata as published: the resource, its authorization servers and its scopes. */
+export function protectedResourceMetadata(document) {
+    const metadata = record(document);
+    const resource = oauthUrl(metadata?.resource);
+    if (!resource)
+        return null;
+    return {
+        resource,
+        authorizationServers: Array.isArray(metadata?.authorization_servers)
+            ? metadata.authorization_servers.flatMap((server) => oauthUrl(server) ?? [])
+            : [],
+        scopes: Array.isArray(metadata?.scopes_supported)
+            ? metadata.scopes_supported.filter((scope) => typeof scope === "string")
+            : [],
+    };
+}
+/** RFC 9728 metadata for a resource on the operation's origin: its first authorization server. */
+export function readProtectedResource(document, operationUrl) {
+    const metadata = protectedResourceMetadata(document);
+    if (!metadata || new URL(metadata.resource).origin !== new URL(operationUrl).origin)
+        return null;
+    const [authorizationServer] = metadata.authorizationServers;
+    return authorizationServer ? { authorizationServer, scopes: metadata.scopes } : null;
+}
+/**
+ * Where an authorization server's metadata is, in the order MCP clients try:
+ * RFC 8414 with the issuer's path inserted, OpenID with it inserted, OpenID
+ * with it appended; or, for an issuer without a path, RFC 8414 then OpenID.
+ */
+export function authorizationServerMetadataUrls(issuer) {
+    const url = new URL(issuer);
+    const path = url.pathname.replace(/\/+$/u, "");
+    return path
+        ? [
+            `${url.origin}/.well-known/oauth-authorization-server${path}`,
+            `${url.origin}/.well-known/openid-configuration${path}`,
+            `${url.origin}${path}/.well-known/openid-configuration`,
+        ]
+        : [
+            `${url.origin}/.well-known/oauth-authorization-server`,
+            `${url.origin}/.well-known/openid-configuration`,
+        ];
+}
+const JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+/** Server metadata for exactly this issuer (RFC 8414 §3.3), or null. */
+export function readAuthorizationServer(document, issuer) {
+    const metadata = record(document);
+    const stated = oauthUrl(metadata?.issuer);
+    const authorizationEndpoint = oauthUrl(metadata?.authorization_endpoint);
+    const registration = agentRegistration(metadata?.agent_auth);
+    if (!stated || trimmed(stated) !== trimmed(issuer))
+        return null;
+    if (!authorizationEndpoint && !registration)
+        return null;
+    const strings = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+    const grants = strings(metadata?.grant_types_supported);
+    return {
+        issuer: stated,
+        authorizationEndpoint,
+        registrationEndpoint: oauthUrl(metadata?.registration_endpoint),
+        clientIdMetadataDocument: metadata?.client_id_metadata_document_supported === true,
+        pkce: strings(metadata?.code_challenge_methods_supported).includes("S256"),
+        registration,
+        renewal: grants.includes("refresh_token") ||
+            (registration !== null && grants.includes(JWT_BEARER_GRANT)),
+        revocation: oauthUrl(metadata?.revocation_endpoint) !== null,
+    };
+}
+/**
+ * auth.md's `agent_auth` block: an `identity_endpoint` the agent registers at,
+ * and the registration types it accepts (`identity_types_supported`).
+ */
+function agentRegistration(value) {
+    const block = record(value);
+    if (!block || !oauthUrl(block.identity_endpoint))
+        return null;
+    const types = Array.isArray(block.identity_types_supported) ? block.identity_types_supported : [];
+    if (types.includes("anonymous"))
+        return "agent";
+    return types.includes("service_auth") || types.includes("identity_assertion")
+        ? "claimable"
+        : null;
+}
+/** The client id a dynamic registration returned, or null. */
+export function registeredClientId(document) {
+    const id = record(document)?.client_id;
+    return typeof id === "string" && id.length > 0 && id.length <= 512 ? id : null;
+}
+/**
+ * The PKCE authorization request a probe sends: Sourcey's client, its redirect
+ * URI, a challenge derived from the run's nonce, and the resource and scope the
+ * chain named. Sourcey never redeems a code, so the verifier is never sent.
+ */
+export function authorizationRequestUrl(input) {
+    const url = new URL(input.authorizationEndpoint);
+    const verifier = base64url(sha256(`sourcey.agent-readiness-pkce:${input.nonce}`));
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", input.clientId);
+    url.searchParams.set("redirect_uri", AGENT_READINESS_REDIRECT_URI);
+    url.searchParams.set("state", input.nonce);
+    url.searchParams.set("code_challenge", base64url(sha256(verifier)));
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("resource", input.resource);
+    if (input.scopes.length > 0)
+        url.searchParams.set("scope", input.scopes.join(" "));
+    return url.href;
+}
+/**
+ * Whether an answered authorization request reached consent: the server
+ * accepted it and moved to the person's sign-in or consent, answering with a
+ * page (2xx HTML) or redirecting, with no `error`, anywhere but back to
+ * Sourcey. A redirect back carries an error or a code Sourcey discards; a
+ * redirect carrying `error` refused the client; any other answer refused it
+ * too. An unanswered request is residue (`probeUnanswered`) and never read here.
+ */
+export function consentReached(record) {
+    if (unansweredRecord(record) || record.outcome !== "responded")
+        return false;
+    const { status, body } = record.response;
+    if (status >= 200 && status <= 299)
+        return body.media_type === "text/html";
+    if (status >= 300 && status <= 399) {
+        const location = responseHeader(record, "location");
+        if (location === null)
+            return false;
+        let target;
+        try {
+            target = new URL(location, record.request.url);
+        }
+        catch {
+            return false;
+        }
+        const back = new URL(AGENT_READINESS_REDIRECT_URI);
+        return (!target.searchParams.has("error") &&
+            !(target.origin === back.origin && target.pathname === back.pathname));
+    }
+    return false;
+}
+function sha256(text) {
+    return createHash("sha256").update(text, "utf8").digest();
+}
+function base64url(bytes) {
+    return bytes.toString("base64url");
+}
+function trimmed(url) {
+    return url.replace(/\/+$/u, "");
+}
+/** An OAuth URL (RFC 8414, RFC 9728): HTTPS, with no credentials and no fragment. */
+function oauthUrl(value) {
+    const url = httpsUrl(value);
+    return url !== null && new URL(url).hash === "" ? url : null;
+}
+//# sourceMappingURL=authority.js.map

package/dist/modules/agent-readiness-engine/src/authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority.js","sourceRoot":"","sources":["../../../../modules/agent-readiness-engine/src/authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,4BAA4B,EAAE,MAAM,iDAAiD,CAAC;AAC/F,OAAO,EAAkB,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhE;;;;;;;GAOG;AAEH,iGAAiG;AACjG,MAAM,UAAU,eAAe,CAAC,MAAsB;IACpD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC;AACnF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,QAAgB,EAChB,SAA2B;IAE3B,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC5D,IAAI,KAAK;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC/C,OAAO;QACL,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,wCAAwC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,GAAG,GAAG,CAAC,MAAM,uCAAuC;KACrD,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,yBAAyB,CAAC,QAAiB;IAKzD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO;QACL,QAAQ;QACR,oBAAoB,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,qBAAqB,CAAC;YAClE,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5E,CAAC,CAAC,EAAE;QACN,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,gBAAgB,CAAC;YAC/C,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YACzF,CAAC,CAAC,EAAE;KACP,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,qBAAqB,CACnC,QAAiB,EACjB,YAAoB;IAEpB,MAAM,QAAQ,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACjG,MAAM,CAAC,mBAAmB,CAAC,GAAG,QAAQ,CAAC,oBAAoB,CAAC;IAC5D,OAAO,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAAC,MAAc;IAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC/C,OAAO,IAAI;QACT,CAAC,CAAC;YACE,GAAG,GAAG,CAAC,MAAM,0CAA0C,IAAI,EAAE;YAC7D,GAAG,GAAG,CAAC,MAAM,oCAAoC,IAAI,EAAE;YACvD,GAAG,GAAG,CAAC,MAAM,GAAG,IAAI,mCAAmC;SACxD;QACH,CAAC,CAAC;YACE,GAAG,GAAG,CAAC,MAAM,yCAAyC;YACtD,GAAG,GAAG,CAAC,MAAM,mCAAmC;SACjD,CAAC;AACR,CAAC;AAuBD,MAAM,gBAAgB,GAAG,6CAA6C,CAAC;AAEvE,wEAAwE;AACxE,MAAM,UAAU,uBAAuB,CACrC,QAAiB,EACjB,MAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,qBAAqB,GAAG,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,CAAC,qBAAqB,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,OAAO,GAAG,CAAC,KAAc,EAAE,EAAE,CACjC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;IACxD,OAAO;QACL,MAAM,EAAE,MAAM;QACd,qBAAqB;QACrB,oBAAoB,EAAE,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;QAC/D,wBAAwB,EAAE,QAAQ,EAAE,qCAAqC,KAAK,IAAI;QAClF,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,gCAAgC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC1E,YAAY;QACZ,OAAO,EACL,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;YAChC,CAAC,YAAY,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAC9D,UAAU,EAAE,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC,KAAK,IAAI;KAC7D,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,OAAO,CAAC;IAChD,OAAO,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QAC3E,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,kBAAkB,CAAC,QAAiB;IAClD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC;IACvC,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAMvC;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,gCAAgC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAClF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,4BAA4B,CAAC,CAAC;IACnE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACpE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACnF,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,MAAsB;IACnD,IAAI,gBAAgB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAC7E,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IACzC,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,UAAU,KAAK,WAAW,CAAC;IAC3E,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACpD,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,4BAA4B,CAAC,CAAC;QACnD,OAAO,CACL,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;YACjC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,qFAAqF;AACrF,SAAS,QAAQ,CAAC,KAAc;IAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,GAAG,KAAK,IAAI,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC"}

package/dist/modules/agent-readiness-engine/src/challenges.d.ts

@@ -0,0 +1,13 @@
+/** One authentication challenge: its scheme, lower-cased, and its parameters by lower-cased name. */
+export interface Challenge {
+    readonly scheme: string;
+    readonly params: Readonly<Record<string, string>>;
+}
+/**
+ * The challenges a `WWW-Authenticate` value carries, as RFC 9110 §11.6.1
+ * writes them: comma-separated, each a scheme followed by `name=value`
+ * parameters (a value a token or a quoted string) or a token68. A parameter
+ * before any scheme belongs to no challenge and is dropped.
+ */
+export declare function parseChallenges(header: string): readonly Challenge[];
+//# sourceMappingURL=challenges.d.ts.map

package/dist/modules/agent-readiness-engine/src/challenges.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenges.d.ts","sourceRoot":"","sources":["../../../../modules/agent-readiness-engine/src/challenges.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACnD;AAID;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,SAAS,EAAE,CAwDpE"}

package/dist/modules/agent-readiness-engine/src/challenges.js

@@ -0,0 +1,67 @@
+const TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+/u;
+/**
+ * The challenges a `WWW-Authenticate` value carries, as RFC 9110 §11.6.1
+ * writes them: comma-separated, each a scheme followed by `name=value`
+ * parameters (a value a token or a quoted string) or a token68. A parameter
+ * before any scheme belongs to no challenge and is dropped.
+ */
+export function parseChallenges(header) {
+    const challenges = [];
+    let rest = header;
+    const skip = (pattern) => {
+        rest = rest.replace(pattern, "");
+    };
+    while (rest.length > 0) {
+        skip(/^[\s,]+/u);
+        const token = TOKEN.exec(rest)?.[0];
+        if (!token)
+            break;
+        rest = rest.slice(token.length);
+        skip(/^\s*/u);
+        if (rest.startsWith("=") && !rest.startsWith("==")) {
+            // A parameter: of the challenge open now, or of none.
+            rest = rest.slice(1);
+            skip(/^\s*/u);
+            const value = readValue();
+            const open = challenges.at(-1);
+            if (open && value !== null)
+                open.params[token.toLowerCase()] = value;
+            continue;
+        }
+        const challenge = { scheme: token.toLowerCase(), params: {} };
+        challenges.push(challenge);
+        // A token68 directly after the scheme, such as `Basic dXNlcjpwYXNz`.
+        const token68 = /^[A-Za-z0-9._~+/-]+=*(?=\s*(?:,|$))/u.exec(rest)?.[0];
+        if (token68 && !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+\s*=[^=]/u.test(rest)) {
+            rest = rest.slice(token68.length);
+        }
+    }
+    return challenges;
+    function readValue() {
+        if (rest.startsWith('"')) {
+            let value = "";
+            let index = 1;
+            while (index < rest.length) {
+                const char = rest[index];
+                if (char === "\\" && index + 1 < rest.length) {
+                    value += rest[index + 1];
+                    index += 2;
+                    continue;
+                }
+                if (char === '"') {
+                    rest = rest.slice(index + 1);
+                    return value;
+                }
+                value += char;
+                index += 1;
+            }
+            rest = "";
+            return null;
+        }
+        const token = TOKEN.exec(rest)?.[0] ?? null;
+        if (token)
+            rest = rest.slice(token.length);
+        return token;
+    }
+}
+//# sourceMappingURL=challenges.js.map

package/dist/modules/agent-readiness-engine/src/challenges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenges.js","sourceRoot":"","sources":["../../../../modules/agent-readiness-engine/src/challenges.ts"],"names":[],"mappings":"AAMA,MAAM,KAAK,GAAG,+BAA+B,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,UAAU,GAAyD,EAAE,CAAC;IAC5E,IAAI,IAAI,GAAG,MAAM,CAAC;IAClB,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE;QAC/B,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,UAAU,CAAC,CAAC;QACjB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,MAAM;QAClB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,CAAC;QACd,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,sDAAsD;YACtD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,CAAC;YACd,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,IAAI,IAAI,KAAK,KAAK,IAAI;gBAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC;YACrE,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,EAA4B,EAAE,CAAC;QACxF,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,qEAAqE;QACrE,MAAM,OAAO,GAAG,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACvE,IAAI,OAAO,IAAI,CAAC,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;IAElB,SAAS,SAAS;QAChB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAW,CAAC;gBACnC,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;oBAC7C,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;oBACzB,KAAK,IAAI,CAAC,CAAC;oBACX,SAAS;gBACX,CAAC;gBACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBACjB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;oBAC7B,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,KAAK,IAAI,IAAI,CAAC;gBACd,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;YACD,IAAI,GAAG,EAAE,CAAC;YACV,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC5C,IAAI,KAAK;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/modules/agent-readiness-engine/src/documents.d.ts

@@ -0,0 +1,21 @@
+/** Reading the documents a service publishes: their shape only, never their prose. */
+/** A JSON object, or null for anything else. */
+export declare function record(value: unknown): Record<string, unknown> | null;
+/** An HTTPS URL carrying no credentials, normalised, or null. */
+export declare function httpsUrl(value: unknown): string | null;
+/** Strict UTF-8, or null for bytes that are not. */
+export declare function utf8(bytes: Uint8Array): string | null;
+/** Parsed JSON, or undefined for text that is not. */
+export declare function json(text: string): unknown;
+/**
+ * The OpenAPI 3.x version a document states, when it is one: its `openapi`
+ * version and the `info` object (a title and a version) OpenAPI requires.
+ */
+export declare function openApiVersion(document: Record<string, unknown> | null): string | null;
+/**
+ * A JSON or YAML document parsed, or undefined for text that is neither:
+ * vendors publish OpenAPI documents in both. Aliases are bounded, so a small
+ * document cannot expand into a large one.
+ */
+export declare function jsonOrYaml(text: string): unknown;
+//# sourceMappingURL=documents.d.ts.map

package/dist/modules/agent-readiness-engine/src/documents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"documents.d.ts","sourceRoot":"","sources":["../../../../modules/agent-readiness-engine/src/documents.ts"],"names":[],"mappings":"AAEA,sFAAsF;AAEtF,gDAAgD;AAChD,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAIrE;AAED,iEAAiE;AACjE,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAQtD;AAED,oDAAoD;AACpD,wBAAgB,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAMrD;AAED,sDAAsD;AACtD,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAM1C;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAStF;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQhD"}

package/dist/modules/agent-readiness-engine/src/documents.js

@@ -0,0 +1,69 @@
+import { parse as parseYaml } from "yaml";
+/** Reading the documents a service publishes: their shape only, never their prose. */
+/** A JSON object, or null for anything else. */
+export function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
+/** An HTTPS URL carrying no credentials, normalised, or null. */
+export function httpsUrl(value) {
+    if (typeof value !== "string")
+        return null;
+    try {
+        const url = new URL(value);
+        return url.protocol === "https:" && !url.username && !url.password ? url.href : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Strict UTF-8, or null for bytes that are not. */
+export function utf8(bytes) {
+    try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        return null;
+    }
+}
+/** Parsed JSON, or undefined for text that is not. */
+export function json(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The OpenAPI 3.x version a document states, when it is one: its `openapi`
+ * version and the `info` object (a title and a version) OpenAPI requires.
+ */
+export function openApiVersion(document) {
+    const version = document?.openapi;
+    const info = record(document?.info);
+    return typeof version === "string" &&
+        /^3\.\d+\.\d+$/u.test(version) &&
+        typeof info?.title === "string" &&
+        typeof info.version === "string"
+        ? version
+        : null;
+}
+/**
+ * A JSON or YAML document parsed, or undefined for text that is neither:
+ * vendors publish OpenAPI documents in both. Aliases are bounded, so a small
+ * document cannot expand into a large one.
+ */
+export function jsonOrYaml(text) {
+    const parsed = json(text);
+    if (parsed !== undefined)
+        return parsed;
+    try {
+        return parseYaml(text, { maxAliasCount: 100 });
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=documents.js.map

package/dist/modules/agent-readiness-engine/src/documents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documents.js","sourceRoot":"","sources":["../../../../modules/agent-readiness-engine/src/documents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C,sFAAsF;AAEtF,gDAAgD;AAChD,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,IAAI,CAAC,KAAiB;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,IAAI,CAAC,IAAY;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAwC;IACrE,MAAM,OAAO,GAAG,QAAQ,EAAE,OAAO,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACpC,OAAO,OAAO,OAAO,KAAK,QAAQ;QAChC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;QAC9B,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ;QAC/B,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAChC,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAY,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/modules/agent-readiness-engine/src/naming.d.ts

@@ -0,0 +1,19 @@
+/**
+ * When a discovery fact names a job's endpoint (north star §5.2, Discover).
+ * The engine rates Discover by this rule, and a card marks the surface the
+ * job's request reached by the same one.
+ */
+/**
+ * Facts that name an interface an agent can call; others (metadata,
+ * registration) do not. An API catalog names an API through the OpenAPI it
+ * links to, whose servers are `openapi_server` facts; its anchor alone does not.
+ */
+export declare const AGENT_READINESS_NAMING_FACTS: ReadonlySet<string>;
+/** A URL names an endpoint when it gives its exact URI or a base the URI sits under. */
+export declare function agentReadinessNamesEndpoint(value: string, uri: string): boolean;
+/** A discovery fact that names the endpoint: one of the naming facts, naming it. */
+export declare function agentReadinessFactNamesEndpoint(fact: {
+    readonly fact: string;
+    readonly value: string;
+}, uri: string): boolean;
+//# sourceMappingURL=naming.d.ts.map

package/dist/modules/agent-readiness-engine/src/naming.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"naming.d.ts","sourceRoot":"","sources":["../../../../modules/agent-readiness-engine/src/naming.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAAE,WAAW,CAAC,MAAM,CAM3D,CAAC;AAEH,wFAAwF;AACxF,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAI/E;AAED,oFAAoF;AACpF,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EACvD,GAAG,EAAE,MAAM,GACV,OAAO,CAIT"}

package/dist/modules/agent-readiness-engine/src/naming.js

@@ -0,0 +1,28 @@
+/**
+ * When a discovery fact names a job's endpoint (north star §5.2, Discover).
+ * The engine rates Discover by this rule, and a card marks the surface the
+ * job's request reached by the same one.
+ */
+/**
+ * Facts that name an interface an agent can call; others (metadata,
+ * registration) do not. An API catalog names an API through the OpenAPI it
+ * links to, whose servers are `openapi_server` facts; its anchor alone does not.
+ */
+export const AGENT_READINESS_NAMING_FACTS = new Set([
+    "mcp_endpoint",
+    "ard_entry",
+    "openapi_server",
+    "oauth_protected_resource",
+    "documentation_route",
+]);
+/** A URL names an endpoint when it gives its exact URI or a base the URI sits under. */
+export function agentReadinessNamesEndpoint(value, uri) {
+    const base = value.replace(/[?#].*$/u, "").replace(/\/+$/u, "");
+    const endpoint = uri.replace(/[?#].*$/u, "").replace(/\/+$/u, "");
+    return endpoint === base || endpoint.startsWith(`${base}/`);
+}
+/** A discovery fact that names the endpoint: one of the naming facts, naming it. */
+export function agentReadinessFactNamesEndpoint(fact, uri) {
+    return (AGENT_READINESS_NAMING_FACTS.has(fact.fact) && agentReadinessNamesEndpoint(fact.value, uri));
+}
+//# sourceMappingURL=naming.js.map

package/dist/modules/agent-readiness-engine/src/naming.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"naming.js","sourceRoot":"","sources":["../../../../modules/agent-readiness-engine/src/naming.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC;IACvE,cAAc;IACd,WAAW;IACX,gBAAgB;IAChB,0BAA0B;IAC1B,qBAAqB;CACtB,CAAC,CAAC;AAEH,wFAAwF;AACxF,MAAM,UAAU,2BAA2B,CAAC,KAAa,EAAE,GAAW;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,+BAA+B,CAC7C,IAAuD,EACvD,GAAW;IAEX,OAAO,CACL,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAC5F,CAAC;AACJ,CAAC"}

package/dist/modules/agent-readiness-engine/src/path.d.ts

@@ -1,24 +1,77 @@
-import { type Digest } from "provenry/primitives";
-import { type AgentReadinessJob, type AgentReadinessJobBinding, type AgentReadinessRunRecord, type AgentReadinessStepResult } from "../../../contracts/agent-readiness/src/index.js";
-import type { AgentReadinessPolicy } from "../../../contracts/agent-readiness/src/operate-policy.js";
+import type { AgentReadinessPolicy } from "../../../contracts/agent-readiness/src/grade-policy.js";
+import { type AgentReadinessJob, type AgentReadinessJobBinding, type AgentReadinessJobOperation, type AgentReadinessJobResult, type AgentReadinessRunRecord, type AgentReadinessStep, type AgentReadinessStepResult } from "../../../contracts/agent-readiness/src/index.js";
+/** One interface's path, and whether a later run is due soon to settle or reproduce it. */
+export interface EvaluatedPath {
+    readonly steps: readonly AgentReadinessStepResult[];
+    /** The job itself, beside the steps (north star §5.6, the job). */
+    readonly job: AgentReadinessJobResult;
+    /**
+     * A later run can settle what this path leaves open: a page answer not yet
+     * reproduced, or a failure of the job not yet reproduced.
+     */
+    readonly reproducible: boolean;
+    /** The probe run whose discovery decided Discover; null when none did. */
+    readonly discoveryRun: AgentReadinessRunRecord | null;
+    /** The binding's run that decided its outcomes, assessed or not; null for a probed path. */
+    readonly verifiedRun: AgentReadinessRunRecord | null;
+    /** The probe runs that reproduce a read's standing answer: unanswered on each, since it last answered. */
+    readonly standingRuns: readonly AgentReadinessRunRecord[];
+}
+/**
+ * The probed path of one interface (north star §5.6). The latest probe run that
+ * answered the operation decides its steps; a run that left its request, its
+ * malformed request, its spec, its authority chain or a declared page
+ * unanswered decides nothing, since residue is never a fact. Discovery's
+ * latest run decides Discover and the payment manifests, unless an unanswered
+ * read could change them: then the latest run whose reads were all answered,
+ * or left unanswered only the service's standing answers, does. Earlier runs
+ * count only to reproduce a page answer or a standing answer.
+ */
+export declare function evaluateProbePath(input: {
+    readonly operation: AgentReadinessJobOperation;
+    /** The operation's declared endpoint URI; null for a spec operation. */
+    readonly endpoint: string | null;
+    readonly policy: Pick<AgentReadinessPolicy, "reproduction">;
+    /** The vendor's sales or approval pages that gate this interface, by page id. */
+    readonly accessGates: readonly string[];
+    /** The settings a person turns on once before an agent can use this interface, by page id. */
+    readonly accessSettings: readonly string[];
+    /** The listing rules out a checkout: the job is free, or paid per call by its request's offer. */
+    readonly checkoutRuledOut: boolean;
+    /** Probe runs of the profile's current declaration revision, any order. */
+    readonly runs: readonly AgentReadinessRunRecord[];
+}): EvaluatedPath;
 /**
- * The Operate path a profile's runs establish: one outcome per step, each
- * resting on entries of the runs. The latest run decides every step; earlier
- * runs count only to reproduce a refusal, the one way a step is `blocked`.
- * Documentation never enters: only exchanges, discovery attempts, recorded
- * credentials and recorded human steps.
+ * The verified path of one binding: what performing the job with its authority
+ * establishes (north star §5.6, precedence). Only the vendor's own runs can
+ * lower a letter: a refusal of authority a vendor run proved valid counts when
+ * the vendor's latest run holds it and its earlier runs reproduce it (the
+ * job's refusal makes the job `unavailable`, Authority's makes that step
+ * `gated`, and a 402 is a balance a person tops up: Pay's recurring
+ * `workaround`), and so do failed assertions reproduced the same way (the job
+ * `unavailable`). Otherwise the latest run that did the job decides while it
+ * is fresh; a failing run from anyone else never lowers a letter.
  */
 export declare function evaluatePath(input: {
     readonly job: AgentReadinessJob;
     readonly binding: AgentReadinessJobBinding;
-    readonly policy: Pick<AgentReadinessPolicy, "blocked">;
+    readonly policy: Pick<AgentReadinessPolicy, "reproduction" | "fresh_for_days">;
+    /** This binding's verified runs, any order. */
     readonly runs: readonly AgentReadinessRunRecord[];
     /** Declared endpoint URIs by id. */
     readonly endpoints: ReadonlyMap<string, string>;
-}): {
-    readonly runDigest: Digest;
-    readonly steps: readonly AgentReadinessStepResult[];
-};
-/** A listing no binding has run: every step not assessed, so no letter. */
-export declare function unexercisedPath(): readonly AgentReadinessStepResult[];
+    /** When freshness is judged: the refresh's own probe run. */
+    readonly asOf: string;
+}): EvaluatedPath;
+/**
+ * Verified outcomes replace probed ones for the steps the verified run
+ * assessed, and for the job (north star §5.6, precedence); a step it left
+ * unassessed keeps its probed outcome.
+ */
+export declare function combinePaths(probed: EvaluatedPath, verified: EvaluatedPath): EvaluatedPath;
+export declare function notAssessed(step: AgentReadinessStep): AgentReadinessStepResult;
+/** The job not yet settled by any run. */
+export declare const NOT_ASSESSED_JOB: AgentReadinessJobResult;
+/** The job unavailable on the run's declaration revision alone: it names no interface for the job. */
+export declare function declaredUnavailable(run: AgentReadinessRunRecord): AgentReadinessJobResult;
 //# sourceMappingURL=path.d.ts.map